fix(security): consume tenant-claim signing key through credential registry

[seonghobae]

Objective

Advance issue #319 on the exact credential-registry stack by removing tenant-claim signing key authority from raw Spring secret injection. This child is intentionally stacked on #354 (DirectoryCredentialRegistry) and remains Draft.

Exact stack identity

• parent feat(security): add standalone directory credential registry #354 exact head/base: d7321e0c29c38553f6e0fa089a9e659d91d08b8a;
• test-only RED head: 85ad5285075432ce1cdee9fd37299cbbeb0d44b8;
• registry-backed implementation head: 4071808854b98731542f44f724242f95f2fcb4c7;
• exact current head: 7a6a1722d15c7e985ed1fb29dc025ee97b6a01a8;
• changed paths: TenantAccessService, its registry-focused regression, and the existing null-secret compatibility test made overload-explicit;
• emitted stacked-head CI and fuzz: terminal-success;
• unresolved inline findings: zero;
• Security Scan/SAST are not inferred because this stacked-base event did not emit them.

RED → implementation → compile repair

The RED regression required TenantAccessService to accept the provider-neutral CredentialRegistry, resolve the server-owned tenant-claims-signing reference for TENANT_CLAIMS_SIGNING, consume opaque snapshot bytes for HMAC verification, and reject credential identity or purpose mismatch.

The implementation added that constructor and exact identity/purpose checks. Exact-head CI on 4071808854b98731542f44f724242f95f2fcb4c7 then exposed one deterministic Java compile failure: the existing new TenantAccessService(null, ...) fixture became ambiguous between the String and CredentialRegistry overloads. Current head keeps production behavior unchanged and casts the legacy null-secret fixture explicitly to String. Exact current-head CI and fuzz now pass.

Contract

Registry-backed tenant verification fails closed unless the returned snapshot has credential identifier tenant-claims-signing and purpose TENANT_CLAIMS_SIGNING. Secret bytes are converted only at the HMAC boundary and the local copy is cleared after constructor initialization. Existing direct-string constructors remain bounded compatibility surfaces for tests and legacy demo wiring; production Spring authority migration remains part of the ordered issue-#319 stack.

Scope boundary

Tenant-claims runtime consumption only. Artifact-token signing, production registry bootstrap, rotation compatibility windows, KMS custody, distributed adapters, and ProductionAuthReadinessConfig migration remain follow-on work. No raw credential material enters PR metadata, logs, telemetry, browser code, or exceptions.

Merge gate

Keep Draft while #354/#344 remain unmerged. Child CI/fuzz success is review evidence, not protected-main merge evidence. After the parent stack reaches protected main, rebuild or retarget this bounded delta onto the new exact protected base and regenerate main-targeted CI, Security Scan, SAST, fuzz, current-head reviews, and qualifying independent approval. No predecessor evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: adc4a4d7-e4eb-4e2f-9156-269e26be02dd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact stacked head 7a6a1722d15c7e985ed1fb29dc025ee97b6a01a8 only. Emitted CI and fuzz are terminal-success and unresolved inline findings are zero. Validate exact credential name/purpose binding, defensive byte handling, and the explicit legacy String-null constructor fixture. Do not infer main-targeted Security/SAST evidence or approve protected merge while #354/#344 remain unmerged.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 19 minutes and 28 seconds before sending another message.